glupteba | 3b2f8f9b26ae8dfed7f3e483d0ababa1a8119f5637c33f05ab338caf5d5eeeec

Analysis

max time kernel
11s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
20-04-2024 20:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3b2f8f9b26ae8dfed7f3e483d0ababa1a8119f5637c33f05ab338caf5d5eeeec.exe
Size

4.2MB
MD5

8a9808fabdd7b34cb324e0bcf3ffc56e
SHA1

7e8952a24f7a6fe0844a43675f5a14f0f41a8f59
SHA256

3b2f8f9b26ae8dfed7f3e483d0ababa1a8119f5637c33f05ab338caf5d5eeeec
SHA512

48c6c63bd2fb95dc68b0dc91cfe81361c0b8ec56b5710fdf99423630b193269b016b67cbb87f91eb965a95fe95783e81f7cc0f4683d38c754cfe660d85233cfe
SSDEEP

98304:jVFRqPMdPA984H0WMAw6acMgLNchhd+W2lPIIo31xn1vrLR/3Lzx:ZFYkS+E0uawLNQ+/9Bo7/B

Score

10^/10

glupteba dropper evasion loader upx

Malware Config

Signatures

Glupteba
Glupteba is a modular loader written in Golang with various components.
loader dropper glupteba

Glupteba payload 19 IoCs

Processes:

resource	yara_rule
behavioral1/memory/3036-2-0x0000000004010000-0x00000000048FB000-memory.dmp	family_glupteba
behavioral1/memory/3036-3-0x0000000000400000-0x0000000001DFF000-memory.dmp	family_glupteba
behavioral1/memory/1928-57-0x0000000003FC0000-0x00000000048AB000-memory.dmp	family_glupteba
behavioral1/memory/1928-58-0x0000000000400000-0x0000000001DFF000-memory.dmp	family_glupteba
behavioral1/memory/3036-84-0x0000000000400000-0x0000000001DFF000-memory.dmp	family_glupteba
behavioral1/memory/1928-155-0x0000000000400000-0x0000000001DFF000-memory.dmp	family_glupteba
behavioral1/memory/4732-257-0x0000000000400000-0x0000000001DFF000-memory.dmp	family_glupteba
behavioral1/memory/4732-267-0x0000000000400000-0x0000000001DFF000-memory.dmp	family_glupteba
behavioral1/memory/4732-270-0x0000000000400000-0x0000000001DFF000-memory.dmp	family_glupteba
behavioral1/memory/4732-273-0x0000000000400000-0x0000000001DFF000-memory.dmp	family_glupteba
behavioral1/memory/4732-276-0x0000000000400000-0x0000000001DFF000-memory.dmp	family_glupteba
behavioral1/memory/4732-279-0x0000000000400000-0x0000000001DFF000-memory.dmp	family_glupteba
behavioral1/memory/4732-282-0x0000000000400000-0x0000000001DFF000-memory.dmp	family_glupteba
behavioral1/memory/4732-285-0x0000000000400000-0x0000000001DFF000-memory.dmp	family_glupteba
behavioral1/memory/4732-288-0x0000000000400000-0x0000000001DFF000-memory.dmp	family_glupteba
behavioral1/memory/4732-291-0x0000000000400000-0x0000000001DFF000-memory.dmp	family_glupteba
behavioral1/memory/4732-294-0x0000000000400000-0x0000000001DFF000-memory.dmp	family_glupteba
behavioral1/memory/4732-297-0x0000000000400000-0x0000000001DFF000-memory.dmp	family_glupteba
behavioral1/memory/4732-300-0x0000000000400000-0x0000000001DFF000-memory.dmp	family_glupteba

Modifies Windows Firewall 2 TTPs 1 IoCs
evasion

Windows Service
T1543.003

Disable or Modify System Firewall
T1562.004

Processes:

netsh.exe

pid process

3952 netsh.exe

pid	process
3952	netsh.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
C:\Windows\windefender.exe	upx
behavioral1/memory/2980-265-0x0000000000400000-0x00000000008DF000-memory.dmp	upx
behavioral1/memory/3476-269-0x0000000000400000-0x00000000008DF000-memory.dmp	upx
behavioral1/memory/3476-275-0x0000000000400000-0x00000000008DF000-memory.dmp	upx

Drops file in System32 directory 2 IoCs

Processes:

powershell.exe

description	ioc	process
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log	powershell.exe

Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs
Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.

System Information Discovery
T1082

Processes:

3b2f8f9b26ae8dfed7f3e483d0ababa1a8119f5637c33f05ab338caf5d5eeeec.exe

description ioc process

File opened (read-only) \??\VBoxMiniRdrDN 3b2f8f9b26ae8dfed7f3e483d0ababa1a8119f5637c33f05ab338caf5d5eeeec.exe
Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.

Processes:

sc.exe

pid process

1496 sc.exe
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exeschtasks.exe

pid process

2940 schtasks.exe
2304 schtasks.exe

description	ioc	process
File opened (read-only)	\??\VBoxMiniRdrDN	3b2f8f9b26ae8dfed7f3e483d0ababa1a8119f5637c33f05ab338caf5d5eeeec.exe

pid	process
1496	sc.exe

pid	process
2940	schtasks.exe
2304	schtasks.exe

Modifies data under HKEY_USERS 64 IoCs

Processes:

3b2f8f9b26ae8dfed7f3e483d0ababa1a8119f5637c33f05ab338caf5d5eeeec.exepowershell.exepowershell.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-434 = "Georgian Daylight Time"	3b2f8f9b26ae8dfed7f3e483d0ababa1a8119f5637c33f05ab338caf5d5eeeec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-231 = "Hawaiian Daylight Time"	3b2f8f9b26ae8dfed7f3e483d0ababa1a8119f5637c33f05ab338caf5d5eeeec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-912 = "Mauritius Standard Time"	3b2f8f9b26ae8dfed7f3e483d0ababa1a8119f5637c33f05ab338caf5d5eeeec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2322 = "Sakhalin Standard Time"	3b2f8f9b26ae8dfed7f3e483d0ababa1a8119f5637c33f05ab338caf5d5eeeec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-242 = "Samoa Standard Time"	3b2f8f9b26ae8dfed7f3e483d0ababa1a8119f5637c33f05ab338caf5d5eeeec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-451 = "Caucasus Daylight Time"	3b2f8f9b26ae8dfed7f3e483d0ababa1a8119f5637c33f05ab338caf5d5eeeec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-721 = "Central Pacific Daylight Time"	3b2f8f9b26ae8dfed7f3e483d0ababa1a8119f5637c33f05ab338caf5d5eeeec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2432 = "Cuba Standard Time"	3b2f8f9b26ae8dfed7f3e483d0ababa1a8119f5637c33f05ab338caf5d5eeeec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-1502 = "Turkey Standard Time"	3b2f8f9b26ae8dfed7f3e483d0ababa1a8119f5637c33f05ab338caf5d5eeeec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2612 = "Bougainville Standard Time"	3b2f8f9b26ae8dfed7f3e483d0ababa1a8119f5637c33f05ab338caf5d5eeeec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-182 = "Mountain Standard Time (Mexico)"	3b2f8f9b26ae8dfed7f3e483d0ababa1a8119f5637c33f05ab338caf5d5eeeec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-92 = "Pacific SA Standard Time"	3b2f8f9b26ae8dfed7f3e483d0ababa1a8119f5637c33f05ab338caf5d5eeeec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-1892 = "Russia TZ 3 Standard Time"	3b2f8f9b26ae8dfed7f3e483d0ababa1a8119f5637c33f05ab338caf5d5eeeec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2341 = "Haiti Daylight Time"	3b2f8f9b26ae8dfed7f3e483d0ababa1a8119f5637c33f05ab338caf5d5eeeec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-772 = "Montevideo Standard Time"	3b2f8f9b26ae8dfed7f3e483d0ababa1a8119f5637c33f05ab338caf5d5eeeec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2792 = "Novosibirsk Standard Time"	3b2f8f9b26ae8dfed7f3e483d0ababa1a8119f5637c33f05ab338caf5d5eeeec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2141 = "Transbaikal Daylight Time"	3b2f8f9b26ae8dfed7f3e483d0ababa1a8119f5637c33f05ab338caf5d5eeeec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2061 = "North Korea Daylight Time"	3b2f8f9b26ae8dfed7f3e483d0ababa1a8119f5637c33f05ab338caf5d5eeeec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-202 = "US Mountain Standard Time"	3b2f8f9b26ae8dfed7f3e483d0ababa1a8119f5637c33f05ab338caf5d5eeeec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-104 = "Central Brazilian Daylight Time"	3b2f8f9b26ae8dfed7f3e483d0ababa1a8119f5637c33f05ab338caf5d5eeeec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2041 = "Eastern Daylight Time (Mexico)"	3b2f8f9b26ae8dfed7f3e483d0ababa1a8119f5637c33f05ab338caf5d5eeeec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-982 = "Kamchatka Standard Time"	3b2f8f9b26ae8dfed7f3e483d0ababa1a8119f5637c33f05ab338caf5d5eeeec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2511 = "Lord Howe Daylight Time"	3b2f8f9b26ae8dfed7f3e483d0ababa1a8119f5637c33f05ab338caf5d5eeeec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2062 = "North Korea Standard Time"	3b2f8f9b26ae8dfed7f3e483d0ababa1a8119f5637c33f05ab338caf5d5eeeec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-441 = "Arabian Daylight Time"	3b2f8f9b26ae8dfed7f3e483d0ababa1a8119f5637c33f05ab338caf5d5eeeec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-252 = "Dateline Standard Time"	3b2f8f9b26ae8dfed7f3e483d0ababa1a8119f5637c33f05ab338caf5d5eeeec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-352 = "FLE Standard Time"	3b2f8f9b26ae8dfed7f3e483d0ababa1a8119f5637c33f05ab338caf5d5eeeec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-1801 = "Line Islands Daylight Time"	3b2f8f9b26ae8dfed7f3e483d0ababa1a8119f5637c33f05ab338caf5d5eeeec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-1831 = "Russia TZ 2 Daylight Time"	3b2f8f9b26ae8dfed7f3e483d0ababa1a8119f5637c33f05ab338caf5d5eeeec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-122 = "SA Pacific Standard Time"	3b2f8f9b26ae8dfed7f3e483d0ababa1a8119f5637c33f05ab338caf5d5eeeec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-562 = "SE Asia Standard Time"	3b2f8f9b26ae8dfed7f3e483d0ababa1a8119f5637c33f05ab338caf5d5eeeec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-391 = "Arab Daylight Time"	3b2f8f9b26ae8dfed7f3e483d0ababa1a8119f5637c33f05ab338caf5d5eeeec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-651 = "AUS Central Daylight Time"	3b2f8f9b26ae8dfed7f3e483d0ababa1a8119f5637c33f05ab338caf5d5eeeec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-512 = "Central Asia Standard Time"	3b2f8f9b26ae8dfed7f3e483d0ababa1a8119f5637c33f05ab338caf5d5eeeec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-261 = "GMT Daylight Time"	3b2f8f9b26ae8dfed7f3e483d0ababa1a8119f5637c33f05ab338caf5d5eeeec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-792 = "SA Western Standard Time"	3b2f8f9b26ae8dfed7f3e483d0ababa1a8119f5637c33f05ab338caf5d5eeeec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-602 = "Taipei Standard Time"	3b2f8f9b26ae8dfed7f3e483d0ababa1a8119f5637c33f05ab338caf5d5eeeec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-1662 = "Bahia Standard Time"	3b2f8f9b26ae8dfed7f3e483d0ababa1a8119f5637c33f05ab338caf5d5eeeec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-1021 = "Bangladesh Daylight Time"	3b2f8f9b26ae8dfed7f3e483d0ababa1a8119f5637c33f05ab338caf5d5eeeec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-171 = "Central Daylight Time (Mexico)"	3b2f8f9b26ae8dfed7f3e483d0ababa1a8119f5637c33f05ab338caf5d5eeeec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-842 = "Argentina Standard Time"	3b2f8f9b26ae8dfed7f3e483d0ababa1a8119f5637c33f05ab338caf5d5eeeec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-1041 = "Ulaanbaatar Daylight Time"	3b2f8f9b26ae8dfed7f3e483d0ababa1a8119f5637c33f05ab338caf5d5eeeec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2001 = "Cabo Verde Daylight Time"	3b2f8f9b26ae8dfed7f3e483d0ababa1a8119f5637c33f05ab338caf5d5eeeec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-622 = "Korea Standard Time"	3b2f8f9b26ae8dfed7f3e483d0ababa1a8119f5637c33f05ab338caf5d5eeeec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

Processes:

powershell.exe3b2f8f9b26ae8dfed7f3e483d0ababa1a8119f5637c33f05ab338caf5d5eeeec.exepowershell.exe3b2f8f9b26ae8dfed7f3e483d0ababa1a8119f5637c33f05ab338caf5d5eeeec.exepowershell.exe

pid	process
4996	powershell.exe
4996	powershell.exe
3036	3b2f8f9b26ae8dfed7f3e483d0ababa1a8119f5637c33f05ab338caf5d5eeeec.exe
3036	3b2f8f9b26ae8dfed7f3e483d0ababa1a8119f5637c33f05ab338caf5d5eeeec.exe
4056	powershell.exe
4056	powershell.exe
4056	powershell.exe
1928	3b2f8f9b26ae8dfed7f3e483d0ababa1a8119f5637c33f05ab338caf5d5eeeec.exe
1928	3b2f8f9b26ae8dfed7f3e483d0ababa1a8119f5637c33f05ab338caf5d5eeeec.exe
1928	3b2f8f9b26ae8dfed7f3e483d0ababa1a8119f5637c33f05ab338caf5d5eeeec.exe
1928	3b2f8f9b26ae8dfed7f3e483d0ababa1a8119f5637c33f05ab338caf5d5eeeec.exe
1928	3b2f8f9b26ae8dfed7f3e483d0ababa1a8119f5637c33f05ab338caf5d5eeeec.exe
1928	3b2f8f9b26ae8dfed7f3e483d0ababa1a8119f5637c33f05ab338caf5d5eeeec.exe
1928	3b2f8f9b26ae8dfed7f3e483d0ababa1a8119f5637c33f05ab338caf5d5eeeec.exe
1928	3b2f8f9b26ae8dfed7f3e483d0ababa1a8119f5637c33f05ab338caf5d5eeeec.exe
1928	3b2f8f9b26ae8dfed7f3e483d0ababa1a8119f5637c33f05ab338caf5d5eeeec.exe
1928	3b2f8f9b26ae8dfed7f3e483d0ababa1a8119f5637c33f05ab338caf5d5eeeec.exe
2384	powershell.exe
2384	powershell.exe
2384	powershell.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

Processes:

powershell.exe3b2f8f9b26ae8dfed7f3e483d0ababa1a8119f5637c33f05ab338caf5d5eeeec.exepowershell.exepowershell.exe

description	pid	process
Token: SeDebugPrivilege	4996	powershell.exe
Token: SeDebugPrivilege	3036	3b2f8f9b26ae8dfed7f3e483d0ababa1a8119f5637c33f05ab338caf5d5eeeec.exe
Token: SeImpersonatePrivilege	3036	3b2f8f9b26ae8dfed7f3e483d0ababa1a8119f5637c33f05ab338caf5d5eeeec.exe
Token: SeDebugPrivilege	4056	powershell.exe
Token: SeDebugPrivilege	2384	powershell.exe

Suspicious use of WriteProcessMemory 13 IoCs

Processes:

3b2f8f9b26ae8dfed7f3e483d0ababa1a8119f5637c33f05ab338caf5d5eeeec.exe3b2f8f9b26ae8dfed7f3e483d0ababa1a8119f5637c33f05ab338caf5d5eeeec.execmd.exe

description	pid	process	target process
PID 3036 wrote to memory of 4996	3036	3b2f8f9b26ae8dfed7f3e483d0ababa1a8119f5637c33f05ab338caf5d5eeeec.exe	powershell.exe
PID 3036 wrote to memory of 4996	3036	3b2f8f9b26ae8dfed7f3e483d0ababa1a8119f5637c33f05ab338caf5d5eeeec.exe	powershell.exe
PID 3036 wrote to memory of 4996	3036	3b2f8f9b26ae8dfed7f3e483d0ababa1a8119f5637c33f05ab338caf5d5eeeec.exe	powershell.exe
PID 1928 wrote to memory of 4056	1928	3b2f8f9b26ae8dfed7f3e483d0ababa1a8119f5637c33f05ab338caf5d5eeeec.exe	powershell.exe
PID 1928 wrote to memory of 4056	1928	3b2f8f9b26ae8dfed7f3e483d0ababa1a8119f5637c33f05ab338caf5d5eeeec.exe	powershell.exe
PID 1928 wrote to memory of 4056	1928	3b2f8f9b26ae8dfed7f3e483d0ababa1a8119f5637c33f05ab338caf5d5eeeec.exe	powershell.exe
PID 1928 wrote to memory of 2808	1928	3b2f8f9b26ae8dfed7f3e483d0ababa1a8119f5637c33f05ab338caf5d5eeeec.exe	cmd.exe
PID 1928 wrote to memory of 2808	1928	3b2f8f9b26ae8dfed7f3e483d0ababa1a8119f5637c33f05ab338caf5d5eeeec.exe	cmd.exe
PID 2808 wrote to memory of 3952	2808	cmd.exe	netsh.exe
PID 2808 wrote to memory of 3952	2808	cmd.exe	netsh.exe
PID 1928 wrote to memory of 2384	1928	3b2f8f9b26ae8dfed7f3e483d0ababa1a8119f5637c33f05ab338caf5d5eeeec.exe	powershell.exe
PID 1928 wrote to memory of 2384	1928	3b2f8f9b26ae8dfed7f3e483d0ababa1a8119f5637c33f05ab338caf5d5eeeec.exe	powershell.exe
PID 1928 wrote to memory of 2384	1928	3b2f8f9b26ae8dfed7f3e483d0ababa1a8119f5637c33f05ab338caf5d5eeeec.exe	powershell.exe

C:\Users\Admin\AppData\Local\Temp\3b2f8f9b26ae8dfed7f3e483d0ababa1a8119f5637c33f05ab338caf5d5eeeec.exe
"C:\Users\Admin\AppData\Local\Temp\3b2f8f9b26ae8dfed7f3e483d0ababa1a8119f5637c33f05ab338caf5d5eeeec.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3036

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4996

C:\Users\Admin\AppData\Local\Temp\3b2f8f9b26ae8dfed7f3e483d0ababa1a8119f5637c33f05ab338caf5d5eeeec.exe
"C:\Users\Admin\AppData\Local\Temp\3b2f8f9b26ae8dfed7f3e483d0ababa1a8119f5637c33f05ab338caf5d5eeeec.exe"
2⤵
- Checks for VirtualBox DLLs, possible anti-VM trick
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1928

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
3⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4056

C:\Windows\system32\cmd.exe
C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
3⤵
- Suspicious use of WriteProcessMemory
PID:2808

C:\Windows\system32\netsh.exe
netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
4⤵
- Modifies Windows Firewall
PID:3952

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
3⤵
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2384

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
3⤵
PID:2928

C:\Windows\rss\csrss.exe
C:\Windows\rss\csrss.exe
3⤵
PID:4732

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
4⤵
PID:3672

C:\Windows\SYSTEM32\schtasks.exe
schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
4⤵
- Creates scheduled task(s)
PID:2940

C:\Windows\SYSTEM32\schtasks.exe
schtasks /delete /tn ScheduledUpdate /f
4⤵
PID:4956

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
4⤵
PID:4852

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
4⤵
PID:2596

C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll
4⤵
PID:3772

C:\Windows\SYSTEM32\schtasks.exe
schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
4⤵
- Creates scheduled task(s)
PID:2304

C:\Windows\windefender.exe
"C:\Windows\windefender.exe"
4⤵
PID:2980

C:\Windows\SysWOW64\cmd.exe
cmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
5⤵
PID:4632

C:\Windows\SysWOW64\sc.exe
sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
6⤵
- Launches sc.exe
PID:1496

C:\Windows\windefender.exe
C:\Windows\windefender.exe
1⤵
PID:3476

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_gr1qijky.bsi.ps1
Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
Filesize
281KB

MD5
d98e33b66343e7c96158444127a117f6

SHA1
bb716c5509a2bf345c6c1152f6e3e1452d39d50d

SHA256
5de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1

SHA512
705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Filesize
2KB

MD5
3d086a433708053f9bf9523e1d87a4e8

SHA1
b3ab5d4f282a4c8fe8c3005b8a557ed5a0e37f28

SHA256
6f8fd1b8d9788ad54eaeee329232187e24b7b43393a01aeba2d6e9675231fb69

SHA512
931ae42b4c68a4507ff2342332b08eb407050d47cf4176137ea022d0f6e513c689e998445a04c6d18d4877391705c586bfce0234632b898d41aaed0957996dfd

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize
19KB

MD5
7af63e93cb48849d170aae90ef994154

SHA1
19c9afbbe28a83899a2e9395a548e1ed6c72ce81

SHA256
2d9264c5567469e2c066cce84498cf4de1023cfb5b5287ad0d9a2b1d45dc2eef

SHA512
625e7999a791a1f809c9e531b4c76e14fa74a85d4803dcd18bc8e504f55efe5ba3d6182f0f64bda6477ceca9b858d2f3ffa9432fbcf5219976f75abec008c0f2

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize
19KB

MD5
3bc969bc2cbe6e003c8df7d5839b69df

SHA1
9b33102d5f011ebbacaa67f00e6e97bffae45ad0

SHA256
e8804cd291217758665794fc075b102bb472f4b8c7c7ae0d077499e3fadffcef

SHA512
9714346156cc393398191871e831601b9556c5a73cf9d52cc9cb09765446cecf9a0476a4e1f404177fe2556ce169b4288d7e944774cb9f4233f4dfec4ff7ba45

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize
19KB

MD5
dfcea0ce46be6604e47477dc224cddb5

SHA1
2a5e0736d29bedd4d7f1032f3bc789f7f219ea71

SHA256
0ebf57972e7e36bb5a66f29454a8c0bec0809852e9326f1c15d79a6291e4a189

SHA512
fa6cb67e1b21101b4e57dea7156c5a594ebc1cf2a4f9ffd9f376e2f14c6df7423d35912e2a60168dadfe8658d6fe9c9e8b8333f6dce5de8b124cc9b8c55d1cb6

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize
19KB

MD5
561c2176de170584c66cb0c44a0c471d

SHA1
25efabb55b930cc076ad5d849c3bfe4481327d75

SHA256
e50634709aa650609ac48b39a20410fac014eef8daa4b5ecbed75899b477ee02

SHA512
3082faa9aa5d67036f818165203e150cc2acb0a707e3313c99b7ffeb74a96b6c72ded290eb758c913ae9cf7be0c4784b32569e5a5915d2f402f6bfbe75db5687

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize
19KB

MD5
4a9a1d5132db21fbe8ecc4f24c4a0de0

SHA1
cd8100f9dc8ec7acb80a5f6e716725970656dc34

SHA256
f5f8ecd113fb8772f7b5b2e97a78535c9f1c2d48ad37c1937b3569b8d98161f5

SHA512
b7d8afa51b0893bf54b45e342fd18314f498c249d51631bd7e073b6b80823344d4e448195576d9da57db3b6c33593003fce6196a2e9984c55b972a38fc8e814b

Download Submit
C:\Windows\rss\csrss.exe
Filesize
4.2MB

MD5
8a9808fabdd7b34cb324e0bcf3ffc56e

SHA1
7e8952a24f7a6fe0844a43675f5a14f0f41a8f59

SHA256
3b2f8f9b26ae8dfed7f3e483d0ababa1a8119f5637c33f05ab338caf5d5eeeec

SHA512
48c6c63bd2fb95dc68b0dc91cfe81361c0b8ec56b5710fdf99423630b193269b016b67cbb87f91eb965a95fe95783e81f7cc0f4683d38c754cfe660d85233cfe

Download Submit
C:\Windows\windefender.exe
Filesize
2.0MB

MD5
8e67f58837092385dcf01e8a2b4f5783

SHA1
012c49cfd8c5d06795a6f67ea2baf2a082cf8625

SHA256
166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa

SHA512
40d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec

Download Submit
memory/1928-57-0x0000000003FC0000-0x00000000048AB000-memory.dmp

Filesize
8.9MB

Download
memory/1928-58-0x0000000000400000-0x0000000001DFF000-memory.dmp

Filesize
26.0MB

Download
memory/1928-55-0x0000000003BB0000-0x0000000003FB2000-memory.dmp

Filesize
4.0MB

Download
memory/1928-155-0x0000000000400000-0x0000000001DFF000-memory.dmp

Filesize
26.0MB

Download
memory/1928-126-0x0000000003BB0000-0x0000000003FB2000-memory.dmp

Filesize
4.0MB

Download
memory/2384-93-0x0000000074CE0000-0x0000000075490000-memory.dmp

Filesize
7.7MB

Download
memory/2384-105-0x0000000005EC0000-0x0000000006214000-memory.dmp

Filesize
3.3MB

Download
memory/2384-95-0x0000000002F20000-0x0000000002F30000-memory.dmp

Filesize
64KB

Download
memory/2384-94-0x0000000002F20000-0x0000000002F30000-memory.dmp

Filesize
64KB

Download
memory/2384-123-0x0000000074CE0000-0x0000000075490000-memory.dmp

Filesize
7.7MB

Download
memory/2384-119-0x000000007EF20000-0x000000007EF30000-memory.dmp

Filesize
64KB

Download
memory/2384-121-0x0000000002F20000-0x0000000002F30000-memory.dmp

Filesize
64KB

Download
memory/2384-120-0x0000000002F20000-0x0000000002F30000-memory.dmp

Filesize
64KB

Download
memory/2384-108-0x0000000070B80000-0x0000000070BCC000-memory.dmp

Filesize
304KB

Download
memory/2384-109-0x0000000071300000-0x0000000071654000-memory.dmp

Filesize
3.3MB

Download
memory/2928-124-0x0000000074CE0000-0x0000000075490000-memory.dmp

Filesize
7.7MB

Download
memory/2928-125-0x00000000024C0000-0x00000000024D0000-memory.dmp

Filesize
64KB

Download
memory/2928-137-0x0000000070B80000-0x0000000070BCC000-memory.dmp

Filesize
304KB

Download
memory/2980-265-0x0000000000400000-0x00000000008DF000-memory.dmp

Filesize
4.9MB

Download
memory/3036-84-0x0000000000400000-0x0000000001DFF000-memory.dmp

Filesize
26.0MB

Download
memory/3036-1-0x0000000003C10000-0x000000000400B000-memory.dmp

Filesize
4.0MB

Download
memory/3036-3-0x0000000000400000-0x0000000001DFF000-memory.dmp

Filesize
26.0MB

Download
memory/3036-56-0x0000000003C10000-0x000000000400B000-memory.dmp

Filesize
4.0MB

Download
memory/3036-2-0x0000000004010000-0x00000000048FB000-memory.dmp

Filesize
8.9MB

Download
memory/3476-269-0x0000000000400000-0x00000000008DF000-memory.dmp

Filesize
4.9MB

Download
memory/3476-275-0x0000000000400000-0x00000000008DF000-memory.dmp

Filesize
4.9MB

Download
memory/4056-73-0x00000000712E0000-0x0000000071634000-memory.dmp

Filesize
3.3MB

Download
memory/4056-87-0x0000000006F90000-0x0000000006FA1000-memory.dmp

Filesize
68KB

Download
memory/4056-66-0x00000000020F0000-0x0000000002100000-memory.dmp

Filesize
64KB

Download
memory/4056-65-0x00000000020F0000-0x0000000002100000-memory.dmp

Filesize
64KB

Download
memory/4056-71-0x0000000074CE0000-0x0000000075490000-memory.dmp

Filesize
7.7MB

Download
memory/4056-64-0x0000000005440000-0x0000000005794000-memory.dmp

Filesize
3.3MB

Download
memory/4056-72-0x0000000070B80000-0x0000000070BCC000-memory.dmp

Filesize
304KB

Download
memory/4056-91-0x0000000074CE0000-0x0000000075490000-memory.dmp

Filesize
7.7MB

Download
memory/4056-83-0x0000000006C60000-0x0000000006D03000-memory.dmp

Filesize
652KB

Download
memory/4056-88-0x0000000006FE0000-0x0000000006FF4000-memory.dmp

Filesize
80KB

Download
memory/4056-85-0x000000007FB90000-0x000000007FBA0000-memory.dmp

Filesize
64KB

Download
memory/4056-86-0x00000000020F0000-0x0000000002100000-memory.dmp

Filesize
64KB

Download
memory/4732-300-0x0000000000400000-0x0000000001DFF000-memory.dmp

Filesize
26.0MB

Download
memory/4732-297-0x0000000000400000-0x0000000001DFF000-memory.dmp

Filesize
26.0MB

Download
memory/4732-257-0x0000000000400000-0x0000000001DFF000-memory.dmp

Filesize
26.0MB

Download
memory/4732-294-0x0000000000400000-0x0000000001DFF000-memory.dmp

Filesize
26.0MB

Download
memory/4732-291-0x0000000000400000-0x0000000001DFF000-memory.dmp

Filesize
26.0MB

Download
memory/4732-288-0x0000000000400000-0x0000000001DFF000-memory.dmp

Filesize
26.0MB

Download
memory/4732-285-0x0000000000400000-0x0000000001DFF000-memory.dmp

Filesize
26.0MB

Download
memory/4732-282-0x0000000000400000-0x0000000001DFF000-memory.dmp

Filesize
26.0MB

Download
memory/4732-279-0x0000000000400000-0x0000000001DFF000-memory.dmp

Filesize
26.0MB

Download
memory/4732-276-0x0000000000400000-0x0000000001DFF000-memory.dmp

Filesize
26.0MB

Download
memory/4732-273-0x0000000000400000-0x0000000001DFF000-memory.dmp

Filesize
26.0MB

Download
memory/4732-270-0x0000000000400000-0x0000000001DFF000-memory.dmp

Filesize
26.0MB

Download
memory/4732-267-0x0000000000400000-0x0000000001DFF000-memory.dmp

Filesize
26.0MB

Download
memory/4996-27-0x0000000007200000-0x000000000721A000-memory.dmp

Filesize
104KB

Download
memory/4996-8-0x00000000049A0000-0x00000000049B0000-memory.dmp

Filesize
64KB

Download
memory/4996-53-0x0000000074CE0000-0x0000000075490000-memory.dmp

Filesize
7.7MB

Download
memory/4996-26-0x0000000007880000-0x0000000007EFA000-memory.dmp

Filesize
6.5MB

Download
memory/4996-25-0x0000000007180000-0x00000000071F6000-memory.dmp

Filesize
472KB

Download
memory/4996-24-0x0000000006400000-0x0000000006444000-memory.dmp

Filesize
272KB

Download
memory/4996-23-0x0000000005E70000-0x0000000005EBC000-memory.dmp

Filesize
304KB

Download
memory/4996-22-0x0000000005E30000-0x0000000005E4E000-memory.dmp

Filesize
120KB

Download
memory/4996-21-0x0000000005860000-0x0000000005BB4000-memory.dmp

Filesize
3.3MB

Download
memory/4996-11-0x00000000057F0000-0x0000000005856000-memory.dmp

Filesize
408KB

Download
memory/4996-10-0x0000000005780000-0x00000000057E6000-memory.dmp

Filesize
408KB

Download
memory/4996-9-0x0000000004F80000-0x0000000004FA2000-memory.dmp

Filesize
136KB

Download
memory/4996-5-0x0000000074CE0000-0x0000000075490000-memory.dmp

Filesize
7.7MB

Download
memory/4996-31-0x00000000712C0000-0x0000000071614000-memory.dmp

Filesize
3.3MB

Download
memory/4996-7-0x0000000004FE0000-0x0000000005608000-memory.dmp

Filesize
6.2MB

Download
memory/4996-30-0x0000000070B80000-0x0000000070BCC000-memory.dmp

Filesize
304KB

Download
memory/4996-41-0x0000000007400000-0x000000000741E000-memory.dmp

Filesize
120KB

Download
memory/4996-6-0x00000000049A0000-0x00000000049B0000-memory.dmp

Filesize
64KB

Download
memory/4996-42-0x0000000007420000-0x00000000074C3000-memory.dmp

Filesize
652KB

Download
memory/4996-29-0x00000000073C0000-0x00000000073F2000-memory.dmp

Filesize
200KB

Download
memory/4996-4-0x0000000002850000-0x0000000002886000-memory.dmp

Filesize
216KB

Download
memory/4996-28-0x000000007FD50000-0x000000007FD60000-memory.dmp

Filesize
64KB

Download
memory/4996-43-0x0000000007510000-0x000000000751A000-memory.dmp

Filesize
40KB

Download
memory/4996-44-0x00000000049A0000-0x00000000049B0000-memory.dmp

Filesize
64KB

Download
memory/4996-45-0x00000000075D0000-0x0000000007666000-memory.dmp

Filesize
600KB

Download
memory/4996-46-0x0000000007530000-0x0000000007541000-memory.dmp

Filesize
68KB

Download
memory/4996-47-0x0000000007570000-0x000000000757E000-memory.dmp

Filesize
56KB

Download
memory/4996-48-0x0000000007580000-0x0000000007594000-memory.dmp

Filesize
80KB

Download
memory/4996-49-0x0000000007670000-0x000000000768A000-memory.dmp

Filesize
104KB

Download
memory/4996-50-0x00000000075B0000-0x00000000075B8000-memory.dmp

Filesize
32KB

Download